Resubmissions

28-01-2021 16:49

210128-gd9cenjzne 10

28-01-2021 16:42

210128-e1fb24wmss 10

General

  • Target

    asesx.png

  • Size

    3.4MB

  • Sample

    210128-e1fb24wmss

  • MD5

    6ebd3ead7ff70ff9badedb980b66728a

  • SHA1

    151afd9f5352fd31fdee9af8b1cfa00afd36dd49

  • SHA256

    02de6c38c553ade4460d627cdcd4db065ee9a59bc0a19d0b6f0b04ecdf38be80

  • SHA512

    df4b54808fd4deb144ea1c6eb058d531013d2b2aebbe69b9c72246192874b02924a9d9fd84f4f2d27207021c5075d8949ab3e69926224fac2dc96f271536db85

Malware Config

Extracted

Family

trickbot

Version

100010

Botnet

rob42

C2

5.34.180.180:443

64.74.160.228:443

198.46.198.116:443

5.34.180.185:443

107.152.46.188:443

195.123.241.214:443

23.254.224.2:443

107.172.188.113:443

200.52.147.93:443

185.198.59.45:443

45.14.226.101:443

185.82.126.38:443

85.204.116.139:443

45.155.173.248:443

103.91.244.50:443

45.230.244.20:443

45.226.124.226:443

187.84.95.6:443

186.250.157.116:443

186.137.85.76:443

Attributes
  • autorun
    Name:pwgrab
ecc_pubkey.base64
ecc_pubkey.base64

Targets

    • Target

      asesx.png

    • Size

      3.4MB

    • MD5

      6ebd3ead7ff70ff9badedb980b66728a

    • SHA1

      151afd9f5352fd31fdee9af8b1cfa00afd36dd49

    • SHA256

      02de6c38c553ade4460d627cdcd4db065ee9a59bc0a19d0b6f0b04ecdf38be80

    • SHA512

      df4b54808fd4deb144ea1c6eb058d531013d2b2aebbe69b9c72246192874b02924a9d9fd84f4f2d27207021c5075d8949ab3e69926224fac2dc96f271536db85

    • Trickbot

      Developed in 2016, TrickBot is one of the more recent banking Trojans.

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

MITRE ATT&CK Matrix

Tasks